debian/opensaml vulnerabilities

Latest debian/opensaml CVEs

Newest publication first

1. CVE-2025-31335 The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

   Published 2025-03-28

   Medium·CVSS 4.0 EPSS 0.25%

   The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

2. DLA-4093-1 opensaml - security update

   Published 2025-03-27

   Unknown

3. DSA-5879-1 opensaml - security update

   Published 2025-03-16

   Unknown

4. CVE-2009-3476 Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider soft...

   Published 2009-09-29

   High·CVSS 9.3 EPSS 4.1%

   Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and...

5. CVE-2009-3475 Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fie...

   Published 2009-09-29

   High·CVSS 7.5 EPSS 0.89%

   Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof a...

6. CVE-2009-3474 OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remo...

   Published 2009-09-29

   High·CVSS 7.5 EPSS 1.5%

   OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is des...

7. DSA-1896-1 opensaml shibboleth-sp - potential code execution

   Published 2009-09-28

   Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.